CHANGES did not contain anything useful recently. Skip bigger
changelog-history in normal package. Include also history in doc
package.
Include original release notes in rst format inside doc package. That
format is nice to use from terminal interface, especially when syntax is
highlighted by vim for example.
New Features:
- Add separate query counters for new protocols. [GL #598]
- Implement RFC 9567: EDNS Report-Channel option.[GL #3659]
- Add detailed debugging of update-policy rule matching. [GL #4751]
- Enable runtime selection of FIPS mode in dig and delv. [GL #5046]
Removed Features:
- Move contributed DLZ modules into a separate repository.
DLZ modules should not be used except in testing. [GL #4865]
- Remove RBTDB implementation. [GL #5027]
Features Changes:
- dnssec-ksr now supports KSK rollovers. [GL #4697] [GL #4705]
- Add none parameter to query-source and query-source-v6 to disable IPv4
or IPv6 upstream queries but allow listening to queries from clients on
IPv4 or IPv6.
- Print RFC 7314: EXPIRE option in transfer summary. [GL #5013]
- Add missing EDNS option mnemonics to dig.
- Add new logging module for crypto errors in libisc.
- Emit more helpful log messages for exceeding max-records-per-type.
- Harden key management when key files have become unavailable.
- Reduce memory footprint by optimizing commonly-used data structures. [GL #5022]
And multiple bug fixes.
https://downloads.isc.org/isc/bind9/9.21.3/doc/arm/html/notes.html#notes-for-bind-9-21-3
Avoids terminating with similar failre:
[ RUN ] isc_rwlock_benchmark
PID 38869 exceeded run time limit, sending SIGABRT
FAIL rwlock_test (exit status: 124)
named contains high number of assertions checking expected state of the
daemon. That is part of defensive code style to prevent many attacks.
The most common failure is failing some assertion check in rare
circumstances. Even when this should not happen, try keeping the service
running. If such failed assertion produces coredump just from time to
time, avoid failing hard the whole service. coredumpctl will keep track
of all crashes anyway.
https://downloads.isc.org/isc/bind9/9.19.21/RELEASE-NOTES-bind-9.19.21.html
Security Fixes
- Validating DNS messages containing a lot of DNSSEC signatures could cause
excessive CPU load, leading to a denial-of-service condition. This has
been fixed. (CVE-2023-50387)
ISC would like to thank Elias Heftrig, Haya Schulmann, Niklas Vogel, and
Michael Waidner from the German National Research Center for Applied
Cybersecurity ATHENE for bringing this vulnerability to our attention. [GL #4424]
- Parsing DNS messages with many different names could cause excessive CPU load.
This has been fixed. (CVE-2023-4408)
ISC would like to thank Shoham Danino from Reichman University, Anat Bremler-Barr
from Tel-Aviv University, Yehuda Afek from Tel-Aviv University, and Yuval Shavitt
from Tel-Aviv University for bringing this vulnerability to our attention. [GL #4234]
- Specific queries could cause named to crash with an assertion failure when
nxdomain-redirect was enabled. This has been fixed. (CVE-2023-5517) [GL #4281]
- A bad interaction between DNS64 and serve-stale could cause named to crash with an
assertion failure, when both of these features were enabled. This has been fixed.
(CVE-2023-5679) [GL #4334]
Resolves: CVE-2023-50387 CVE-2023-4408 CVE-2023-5517 CVE-2023-5679
https://downloads.isc.org/isc/bind9/9.19.19/doc/arm/html/notes.html#notes-for-bind-9-19-19
New Features
- Initial support for the PROXYv2 protocol was added. named can now accept PROXYv2 headers over all currently implemented DNS transports and dig can insert these headers into the queries it sends. Please consult the related documentation (allow-proxy, allow-proxy-on, listen-on, and listen-on-v6 for named, dig +proxy and dig +proxy-plain for dig) for additional details. [GL #4388]
Removed Features
- Support for using AES as the DNS COOKIE algorithm (cookie-algorithm aes;) has been removed. The only supported DNS COOKIE algorithm is now the current default, SipHash-2-4. [GL #4421]
- The resolver-nonbackoff-tries and resolver-retry-interval statements have been removed. Using them is now a fatal error. [GL #4405]
Feature Changes
- The maximum number of NSEC3 iterations allowed for validation purposes has been lowered from 150 to 50. DNSSEC responses containing NSEC3 records with iteration counts greater than 50 are now treated as insecure. [GL #4363]
- Following RFC 9276 recommendations, dnssec-policy now only allows an NSEC3 iteration count of 0 for the DNSSEC-signed zones using NSEC3 that the policy manages. [GL #4363]
Upstream has discontinued and remove support for local PDF building in
commit 561a83a29182b00bda9237ae30343d76a68dcdf4. Just remove remaining
bits, it is not likely to return.
It was added in year 2012 without any reference to a bug. Commit
deca2d7733ec49eaf362e3852a38ff53e2826707. I doubt any reason for
that is still relevant today. It was bind 9.9.0, which required it.
Create /etc/pki/tls directory in chroot and mount /etc/pki/tls/cert.pem
file into the chroot. Even though the that file is symlink, mount during
chroot setup will resolve it correctly.
Resolves: rhbz#2196699
